Data Science for Auditors
Week 1: Introduction – Michael Werner
Core challenge for Financial Statement Audits
- Imbalance between automated processing on the companies’ side and manual
audit procedures on the auditors’ side
What is data science?
Data science deals with using advanced data analysis techniques to solve difficult
problems. It uses statistics, scientific computing, scientific methods, processes,
algorithms and systems to extract or extrapolate knowledge and insights from potentially
noisy structured, or unstructured data.
Data Analytics According to the IAASB
- Science and art of discovering and analyzing patterns, deviations and
inconsistencies, and extracting other useful information in the data underlying or
related to the subject matter of an audit through analysis, modelling and
visualization for the purpose of planning or performing the audit.
Insecurity in the profession:
- Audit standards are neutral, they neither encourage the use of innovative audit
data analytics nor prohibit it.
- High regulatory pressure in the profession
- Little innovation, sticking to traditional audit procedures (checkmark mentality)
o Lack of knowledge about advanced Audit Data Analytics
o Difficult to use, we must train it
Week 2: Process mining in the audit – Michael Werner
What is a business process?
A business process is a set of related activities that work together, across the
organisation, to achieve some predetermined organisational goal.
Functional vs Process
What is system documentation?
System documentation encompasses narratives, flowcharts, diagrams and other written
materials that explain how a system works. It covers the who, what, when, where, why
and how of data entry, processing, storage, information outputs and system controls.
Why do we need system documentation (and why important from audit perspective)?
- Process redesign and optimization
- Organizational change
- Knowledge management
- Legal requirements
Business Processes and Financial Statement Audits
1
,Process Mining
The aim of process mining is the extraction of information about business processes
by extracting knowledge from event logs. It is an unsupervised data mining technique for
descriptive, predictive and prescriptive analytics
It graphically describes the dependencies between activities that need to be executed
collectively for realizing a specific business objective. A single execution of a business
process is called a process instance. The model that describes a single process
instance is called process instance model. A process model abstracts from the single
behavior of process instances.
Process Mining Input
- Event ID: each executed activity in a business process creates an event which is
recorded in the event log.
- Event log: table that contains all recorded
events that relate to executed business
activities.
- Case: a set of events in the event log that are
mapped to the same case ID. It represents the
recording of a single execution of a specific
business process.
- Trace: sequence of recorded events in a case.
- Process variants: process executions of a
specific process that represents identical traces.
- Classifiers: ensure the distinctness of cases
and events by mapping unique names to each
case and event.
- Attributes: store additional information that
can be used for analysis purposes.
2
,Deterministic mining algorithms produce defined and reproducible results business
processes.
Mining output
These are two different examples of mining output.
Application areas
- Conformance checking: check whether the first model
that we have aligns with the event log
Horizontal Abstraction Layers and Related Terms
Traditional versus Automated
Test of Controls
Summary of Benefits
Auditor benefits:
- Fact-based with high degree of certainty, full population testing possible
- Risk identification based on the actual process flow
- The testing of certain application controls might not be necessary
3
, - Focus on potentially high-risk deviations from expected process behavior and
substantive testing of exceptions rather than standard low-risk process
transactions
- Visual representation of process flow facilitates communication with the auditee
about analyzed processes.
Auditee benefits:
- More effective and efficient audit
- Identification of potential process improvements
- Fewer resources from audited organization may be needed
- Potential enhancement of internal control system
- Insights into differences of transaction processing across business units, countries,
product groups within the same company and transaction processing
Main process mining opportunities and challenges
Opportunities
- Enhancing business process transparency
- Analyzing business processes from the resource perspective
- Analyzing business process variants and exceptions
- Understanding business process compliance
- Enabling business process comparison and benchmarking
- Identifying business process waste
- Enhancing business process improvement and redesign
- Evaluating business process performance
- Generating intuitive visualizations for business users
- Nurturing evidence-based communication and decision-making
Challenges
- Lack of management support
- Poor data quality
- Complex data preparation
Competing quality criteria
- Fitness: ability of a model to replay all
behavior recorded in the event log
- Simplicity: the simplest model that can
explain the observed behavior should be
preferred
- Precision: the model does not allow additional
behavior very different from the behavior recorded in the event log
- Generalization: a process model is not exclusively restricted to display the
eventually limited record of observed behavior in the event log.
Implications for Using Process Mining: high fitness but poor precision means that
all observed traces can be replayed, but it also allows for many more traces.
o Unfitting model: false negative audit results (compliance violations are not
detected)
o Imprecise model: false positive audit results (compliance violations are
indicated that did not occur in reality)
Challenges for process mining
- Integrations of key information concepts such as financial accounts, internal
controls, materiality etc.
- System boundaries: only data recorded in the source systems can be analyzed.
- Noise and incompleteness: noise refers to rare and infrequent behavior.
Incompleteness means that not all possible behavior is recorded.
- Data extraction: extracting, transforming and loading the source data is a non-
trivial process seldom supported by process mining tools.
- Concept drift: business processes change over time which is not considered by
contemporary process mining tools.
4
Week 1: Introduction – Michael Werner
Core challenge for Financial Statement Audits
- Imbalance between automated processing on the companies’ side and manual
audit procedures on the auditors’ side
What is data science?
Data science deals with using advanced data analysis techniques to solve difficult
problems. It uses statistics, scientific computing, scientific methods, processes,
algorithms and systems to extract or extrapolate knowledge and insights from potentially
noisy structured, or unstructured data.
Data Analytics According to the IAASB
- Science and art of discovering and analyzing patterns, deviations and
inconsistencies, and extracting other useful information in the data underlying or
related to the subject matter of an audit through analysis, modelling and
visualization for the purpose of planning or performing the audit.
Insecurity in the profession:
- Audit standards are neutral, they neither encourage the use of innovative audit
data analytics nor prohibit it.
- High regulatory pressure in the profession
- Little innovation, sticking to traditional audit procedures (checkmark mentality)
o Lack of knowledge about advanced Audit Data Analytics
o Difficult to use, we must train it
Week 2: Process mining in the audit – Michael Werner
What is a business process?
A business process is a set of related activities that work together, across the
organisation, to achieve some predetermined organisational goal.
Functional vs Process
What is system documentation?
System documentation encompasses narratives, flowcharts, diagrams and other written
materials that explain how a system works. It covers the who, what, when, where, why
and how of data entry, processing, storage, information outputs and system controls.
Why do we need system documentation (and why important from audit perspective)?
- Process redesign and optimization
- Organizational change
- Knowledge management
- Legal requirements
Business Processes and Financial Statement Audits
1
,Process Mining
The aim of process mining is the extraction of information about business processes
by extracting knowledge from event logs. It is an unsupervised data mining technique for
descriptive, predictive and prescriptive analytics
It graphically describes the dependencies between activities that need to be executed
collectively for realizing a specific business objective. A single execution of a business
process is called a process instance. The model that describes a single process
instance is called process instance model. A process model abstracts from the single
behavior of process instances.
Process Mining Input
- Event ID: each executed activity in a business process creates an event which is
recorded in the event log.
- Event log: table that contains all recorded
events that relate to executed business
activities.
- Case: a set of events in the event log that are
mapped to the same case ID. It represents the
recording of a single execution of a specific
business process.
- Trace: sequence of recorded events in a case.
- Process variants: process executions of a
specific process that represents identical traces.
- Classifiers: ensure the distinctness of cases
and events by mapping unique names to each
case and event.
- Attributes: store additional information that
can be used for analysis purposes.
2
,Deterministic mining algorithms produce defined and reproducible results business
processes.
Mining output
These are two different examples of mining output.
Application areas
- Conformance checking: check whether the first model
that we have aligns with the event log
Horizontal Abstraction Layers and Related Terms
Traditional versus Automated
Test of Controls
Summary of Benefits
Auditor benefits:
- Fact-based with high degree of certainty, full population testing possible
- Risk identification based on the actual process flow
- The testing of certain application controls might not be necessary
3
, - Focus on potentially high-risk deviations from expected process behavior and
substantive testing of exceptions rather than standard low-risk process
transactions
- Visual representation of process flow facilitates communication with the auditee
about analyzed processes.
Auditee benefits:
- More effective and efficient audit
- Identification of potential process improvements
- Fewer resources from audited organization may be needed
- Potential enhancement of internal control system
- Insights into differences of transaction processing across business units, countries,
product groups within the same company and transaction processing
Main process mining opportunities and challenges
Opportunities
- Enhancing business process transparency
- Analyzing business processes from the resource perspective
- Analyzing business process variants and exceptions
- Understanding business process compliance
- Enabling business process comparison and benchmarking
- Identifying business process waste
- Enhancing business process improvement and redesign
- Evaluating business process performance
- Generating intuitive visualizations for business users
- Nurturing evidence-based communication and decision-making
Challenges
- Lack of management support
- Poor data quality
- Complex data preparation
Competing quality criteria
- Fitness: ability of a model to replay all
behavior recorded in the event log
- Simplicity: the simplest model that can
explain the observed behavior should be
preferred
- Precision: the model does not allow additional
behavior very different from the behavior recorded in the event log
- Generalization: a process model is not exclusively restricted to display the
eventually limited record of observed behavior in the event log.
Implications for Using Process Mining: high fitness but poor precision means that
all observed traces can be replayed, but it also allows for many more traces.
o Unfitting model: false negative audit results (compliance violations are not
detected)
o Imprecise model: false positive audit results (compliance violations are
indicated that did not occur in reality)
Challenges for process mining
- Integrations of key information concepts such as financial accounts, internal
controls, materiality etc.
- System boundaries: only data recorded in the source systems can be analyzed.
- Noise and incompleteness: noise refers to rare and infrequent behavior.
Incompleteness means that not all possible behavior is recorded.
- Data extraction: extracting, transforming and loading the source data is a non-
trivial process seldom supported by process mining tools.
- Concept drift: business processes change over time which is not considered by
contemporary process mining tools.
4
